Free
Website security headers
Whether your website tells browsers to block clickjacking, script injection and insecure cookies.
Reads the headers your site already sends to every visitor.
10 checks
Free security audit
Free Website Security Scan and Vulnerability Check
Our free website security scan checks your security headers, SSL/TLS certificate and DNS records in about a minute. It shows the weaknesses attackers look for first and sends you a score, a grade and a private result by email. We only read what any visitor’s browser can already see.
- 19free checks
- 130checks in our library
- 13security pillars
- About 1 minto your result
Scanning
You can close this page whenever you like. We will email your private result link to when it is ready.
Wrong address? Cancel and start again.
Website security scan result
0out of 100
-
Summary
0Passed
0Warnings
0Failed
About this website
Public information only: DNS, the certificate the website presents, RIPEstat for the network and place, and RDAP for the domain registration.
Full report
Fix everything on this list
The free result shows what is wrong. The full report shows how to fix it, where to make each change, and the evidence behind every result. You get it right after you pay, and we email you the link.
- Every finding with what we saw and why it matters
- Email authentication checks added: SPF, DKIM, DMARC and MTA-STS
- Step by step fix, how to check it, and how to undo it
- Where to change it: Cloudflare, your web server or your host
- Evidence for each result
- Professional PDF report
- Fix file to give to Claude or another AI assistant
$1.99CAD, one time, for this website
Secure payment by Stripe.
Full report
Your full report is unlocked
Every finding, with the steps to fix it. We also emailed these links to you. Keep that email: the links stay private to you.
Open the report
Download the PDF
Download the fix file for an AI assistant
Tip: give the fix file to Claude or another AI assistant and say, "Fix these with me, one at a time."
Example
This is a real example
It is a scan of our own website. Scan your website for free to get the same kind of result in about a minute.
Live from the scanner
Recently scanned websites
The latest 20 websites checked. Only the website name appears here, never the result. To remove a name, email [email protected].
Full report
Unlock the full report
See exactly how to fix each finding, where to change it, and the evidence behind it. It opens right after you pay, and we email you the link.
- Step by step fix for every warning and failure
- Email authentication checks (SPF, DKIM, DMARC) added to your report
- How to check it yourself and how to undo it
- Professional PDF and a fix file for an AI assistant
$1.99CAD, one time, for this website
Secure payment by Stripe. See a sample report first
Fix everything on this list
What the scan covers
What the website security scan checks
Six modules. Three are free for any website. Three connect to your own servers, so they unlock after you prove ownership.
Free
Encryption and certificate
Whether the padlock is valid, old insecure versions are off and renewal will not catch you out.
Opens the same secure connection a browser opens and reads the certificate.
6 checks
Free
DNS health
Whether your domain name system is resilient, signed and free of leaked internal names.
Reads your public DNS records.
3 checks
Locked
Email authentication
Whether criminals can send mail pretending to be you, and whether your own mail reaches inboxes.
Reads your SPF, DKIM, DMARC and MTA-STS records. Included when you unlock the full report.
7 checks
Locked
Mail server connection
Whether every mail server of yours offers encryption with a valid certificate.
Connects to your mail servers. Runs only for the verified owner.
1 check
Locked
DNS server hardening
Whether your name servers refuse to hand your full list of records to strangers.
Asks your name servers for a zone transfer. Runs only for the verified owner.
1 check
Behind the scan
130 security checks in 13 pillars
The free scan is the part of our security library that can be tested from outside, with no login and no changes to your website. The library is wider. It groups 130 checks into 13 pillars, and each check explains why it matters, how to test it, what a pass looks like and how to fix it.
| Pillar | Checks | Where it runs |
|---|---|---|
| HTTP security headers | 10 | Automatic outside scan Free scan |
| TLS and certificates | 6 | Automatic outside scan Free scan |
| DNS | 9 | Automatic outside scan, plus checklist Free scan (3 checks); name server test after verification |
| Mail authentication | 10 | Automatic outside scan, plus checklist After ownership verification |
| Server hardening | 12 | Audit run on the server itself Not in this scan |
| Web application safeguards | 12 | Guided checklist Not in this scan |
| Containers and Docker | 11 | Guided checklist Not in this scan |
| WordPress and CMS | 11 | Guided checklist Not in this scan |
| Cloud and SaaS accounts | 10 | Guided checklist Not in this scan |
| Incident response | 10 | Guided checklist Not in this scan |
| Privacy and compliance | 10 | Guided checklist Not in this scan |
| Vendors and supply chain | 10 | Guided checklist Not in this scan |
| Backups and recovery | 9 | Guided checklist Not in this scan |
What you can point it at
What this is not. It is a configuration and exposure checker. It does not hunt unknown flaws (zero-days), exploit anything, guess passwords or test your application while logged in. A clean result is not proof of safety.
Three steps
How the scan works
Enter your address and email
Pick what to scan. Website checks are free and ticked for you. Locked checks wait for ownership proof.
We read what visitors can see
Headers, certificate and public DNS records, using ordinary requests. You see your place in line and the progress.
Get your score and a private link
You see a score from 0 to 100 with a grade and a result link only you have. Fix instructions are in the full report.
Your grade
What your security score means
The score starts at 100. Each failed check subtracts twice the weight of its severity and each warning subtracts it once, where critical is 10, high 6, medium 3 and low 1. Passed checks, and items we cannot judge from outside, cost nothing.
| Grade | Score | What it means |
|---|---|---|
| A | 90 to 100 | Strong base. Only fine tuning left. |
| B | 80 to 89 | Solid. A few hardening steps are open. |
| C | 70 to 79 | Basics are covered. Several gaps are worth closing. |
| D | 60 to 69 | Many gaps. An attacker has it easier than they should. |
| F | Below 60 | Serious gaps. Fix the failed checks first. |
Questions
Website security scan questions
Short answers about what the scan does, what it does not do and what happens with your result.
What is a website vulnerability check?
A website vulnerability check looks for weaknesses attackers can use, such as missing security headers, outdated encryption, a badly set up certificate or weak DNS settings. DaniMaster’s scan checks these from the outside in about a minute. It does not replace a penetration test of your application code.
What does the free website security scan check?
It checks the headers your website sends, your certificate and encryption settings, and your public DNS records. That is 19 automated checks in three areas, with 9 more after you verify ownership. It reads only what any visitor or any DNS lookup can already see, and it changes nothing on your website.
How many security checks does DaniMaster run?
DaniMaster’s security library holds 130 checks in 13 pillars. The website scan runs the ones that can be tested from outside: 19 free checks on headers, encryption and DNS, and 9 more after you verify ownership. The remaining checks are guided checklists for servers, backups and accounts that no outside scan can see.
Is the scan safe for my website?
Yes. The scan makes the same kind of requests a normal browser makes: it loads your page, opens a secure connection and looks up public DNS records. It does not log in, submit forms, guess passwords or try to break anything.
Why are the email and server checks locked?
Email authentication only reads public DNS records, so it comes with the paid full report. The mail server and name server checks connect to your own servers. We only do that for the verified owner, so nobody can point the scanner at someone else’s systems. That verification is opening soon.
Is my scan result private?
Yes. We do not publish results or list them anywhere. Only the personal link we email to you opens your result, and nobody else can find it by searching.
How long does a website security scan take?
Usually under a minute. When many people scan at once you wait in line, see your place and are taken to the result automatically. If it takes longer, close the page: we email your private result link when it is ready.
Does a low score mean my website was hacked?
No. The score counts missing protective layers, not confirmed break-ins. A low score means an attacker would have an easier time, so the failed checks are worth fixing first. Re-scan after each fix to see your score rise.
Is this a penetration test?
No. It checks your public security configuration. Flaws inside an application, such as injection or broken access control, need a manual review or a penetration test.
What do I get with the full report?
The full report is a one-time payment of $1.99 CAD for the website you scanned. It adds step by step fixes for every warning and failure and where to make them, such as Cloudflare or your web server. It also includes the evidence behind each result, a professional PDF report and a fix file you can give to Claude or another AI assistant. You can open it right after paying and we email you the link. You can see a sample report on this page before you buy.
Want a person to fix what the scan finds?
DaniMaster can fix your security headers, certificate and DNS settings, and run a deeper review of your website. Start with a free AI audit.